PT-2026-25480 · Npm · Openclaw

Publicado 2026-03-03 · Atualizado 2026-03-03

OSV

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

A missing sender-authorization check in Telegram message reaction handling allowed unauthorized users to trigger reaction-derived system events.

Affected Packages / Versions

• Package: openclaw (npm)
• Introduced: 2026.2.17
• Affected: >= 2026.2.17 and <= 2026.2.24
• Latest published at patch time: 2026.2.24
• Patched in release: 2026.2.25

Impact

When reaction notifications are enabled, unauthorized Telegram senders could inject reaction system events despite configured DM/group authorization controls (dmPolicy, allowFrom, groupPolicy, groupAllowFrom).

Fix Commit(s)

• e56b0cf1a04f992ac6ebc775899f48ea31687640

Release Process Note

patched versions is pre-set to the release (2026.2.25) so once npm release 2026.2.25 is published, this advisory can be published without further edits.

OpenClaw thanks @tdjackey for reporting.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

GHSA-QJ22-XQJR-V83V

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qj22-xqjr-v83v · Nota
• https://github.com/openclaw/openclaw/commit/e56b0cf1a04f992ac6ebc775899f48ea31687640 · Nota
• https://osv.dev/vulnerability/GHSA-qj22-xqjr-v83v · Aviso do Fabricante